The Shutter Clicks, and a Data Controller Is Born
There is a moment on every shoot — usually somewhere between the test frames and the first usable take — when a model hands over a photocopy of her passport, signs a single-page release, and the photographer slides both into a manila folder. It is so familiar a ritual that nobody in the room recognises it as a legal event. But it is. The photographer, in that instant, has become a data controller within the meaning of the General Data Protection Regulation, and the obligations attached to that role are considerable.
Almost none of those obligations are being met. The photocopy will be filed alongside hundreds of others in an unlocked drawer, or scanned to a hard drive that is not encrypted, or emailed to an assistant for “the records.” The release itself names a usage right but says nothing about how the underlying identity data will be stored, protected, or eventually destroyed. There is no documented lawful basis. There is no retention schedule. There is no mechanism by which the model can later say delete it and have that request honoured.
This is not a niche compliance issue. It is industry standard. And it is, increasingly, indefensible.
“The folder of paper releases is not a record of consent. It is an unencrypted database of biometric documents, held without lawful basis, by a controller who has not registered as one.”
— The Quiet Position of European Data AuthoritiesThe Folder, the Photocopier, the Unencrypted Drive
To understand the scale of what photographers are doing, it helps to walk through what actually sits inside that folder. A typical model release file, multiplied across a working photographer’s career, contains:
Each ID copy is, on its own, a complete identity-theft kit: full name, date of birth, document number, machine-readable zone, photograph. Stack two hundred of them in a drawer and you have a target. Scan them to a laptop and you have a portable target. Email one to an agency and you have a chain of custody that runs through three unsecured inboxes and ends nobody knows where.
None of this is hypothetical. Italian, French, and Dutch data authorities have each, in recent years, opened proceedings against photography studios and agencies for precisely this configuration of practices. Most are settled quietly. None of them are favourable to the photographer.
What “processing” really means
The instinctive defence — I just kept a copy in case anything came up — misunderstands what the law considers processing. Storing identifying information is processing. Photocopying a passport is processing. Emailing a release-and-ID bundle to a magazine is processing. Each of those acts triggers the photographer’s duties as a controller: lawful basis, purpose limitation, data minimisation, integrity, accountability, and the model’s right to erasure on demand.
In practice, photographers neither know nor honour any of these duties. They could not, even in principle: the paper-and-photocopy model has no infrastructure for them.
What the Law Actually Says
A working photographer does not need to memorise the GDPR. But three of its provisions are worth understanding clearly, because they govern almost everything that happens on a shoot:
Article 5 establishes the principles of processing. Personal data must be collected for specified, explicit, and legitimate purposes; kept for no longer than necessary; processed with integrity and confidentiality. A folder of indefinite-retention ID copies fails three of these on its face.
Article 6 requires a lawful basis for processing. Consent is one such basis — but the consent must be specific, informed, freely given, and revocable. A boilerplate model release that bundles “you consent to everything forever” into a single signature is, in regulators’ view, not consent at all.
Article 9 raises the bar for biometric data used to uniquely identify a person. The photograph in a passport is biometric data. The machine-readable zone is biometric data. When a photographer copies an ID to verify identity, she is processing special-category personal data, which requires either explicit consent for the specific purpose or one of a narrow set of exemptions. “I keep it in a folder” is not one of those exemptions.
Layered above all this is the EU Artificial Intelligence Act, which since 2024 has imposed additional restrictions on the processing of biometric data — including in contexts where photographs may be used to train or fine-tune AI systems. The legal floor has risen. The studio practices have not.
The Myth of the Watertight Release
For decades, photographers have been told that a properly drafted, broadly-worded model release is functionally bulletproof. It is not, and it never was. Two truths that have always been quietly known in the industry have become impossible to ignore.
The first: a release does not extinguish the model’s underlying personality and likeness rights. In Italian, French, German, and Dutch law — among many others — a person retains certain rights over the use of her image regardless of what a release document says. A model can, in defined circumstances, withdraw consent, contest specific uses, or seek the removal of content. The release is a defence; it is not a wall.
The second: the release governs image usage. It does not govern the photographer’s separate obligations as a data controller. A photographer with the most comprehensive release in the world, holding an unencrypted folder of photocopied IDs, is still exposed on the data-protection side — and that exposure is independent of, and unprotected by, any signature on the release itself.
The practical effect is that paper releases now combine the worst of both worlds. They give photographers an inflated sense of legal protection on image rights, while leaving them entirely undefended on the larger and more aggressively enforced ground of data protection. A model can decline to sue for image misuse and simply file a data-protection complaint instead — which is faster, cheaper, and far more likely to succeed.
“The paper release form is a defence against the wrong attack. The case that actually arrives in 2026 is a data-protection complaint, and the folder of photocopied IDs is the evidence used to win it.”
— Christian BertoliniWalk Through Both Sides of the Shutter
The cleanest way to see how badly the paper flow underperforms is to walk the two side by side. Below: the same five stages of a shoot, modelled through the legacy paper-and-photocopy workflow on one side, and through a verified digital consent flow on the other. Use the stage controls to advance.
Two Workflows, Five Stages
The paper release vs the verified digital release across the lifecycle of a single shoot.
The booking confirmation
A booking is confirmed via email and a phone call. The photographer asks the model to bring a photocopy of her passport on the day. No structured identity verification happens before the shoot.
The booking confirmation
Booking triggers an identity verification request to the model via her ProntoID account. The model verifies once against a government source; the photographer sees a confirmed identity before the shoot.
The shift is not cosmetic. At every stage where the paper flow generates risk — an ID copy held without basis, an irrevocable signature on a blanket release, a folder no regulator can audit — the verified flow generates a record that satisfies the law instead. ProntoTag, built on the ProntoID identity layer, is the most developed example of this architecture in the field; the principles are reproducible, but the architecture is the point.
The technical anatomy of the alternative
| Compliance dimension | Paper release + ID copy | Verified digital release |
|---|---|---|
| Identity verification | Visual check of a photocopy | Verified against issuing authority |
| Storage of biometric data | Held indefinitely, unencrypted | Not held by photographer at all |
| Consent granularity | Single blanket signature | Specific, scoped, per-usage |
| Revocability | None — no mechanism exists | Model can revoke at any time |
| Audit trail | A signature, a date, a folder | Cryptographic, timestamped, immutable |
| Legal defensibility | Contestable on both fronts | Substantially stronger record |
It Is Not About Software. It Is About Standing.
A photographer who continues to operate on paper releases in 2026 is not, by default, breaking the law. She is operating on an infrastructure that cannot demonstrate compliance even if she has, in good faith, attempted it. The distinction matters: the GDPR’s accountability principle requires the controller to be able to show compliance, not merely claim it.
Adopting a verified consent flow is not, fundamentally, about the technology. It is about choosing an architecture in which compliance is demonstrable as a matter of course, rather than constructed retroactively in front of a regulator. That is the standing every working photographer should want to occupy. It is also, increasingly, the standing that serious agencies and publications are going to insist on.
The Standard Is Already Changing
The pressure to modernise is not, in the end, going to come from regulators. It is going to come from agencies, publishers, and platforms — the parties downstream of the photographer who themselves have to satisfy data-protection auditors, advertisers, and creator-protection policies. Increasingly, those parties are asking the same question of submitted work: can you show me the consent chain?
A scanned PDF of a paper release with a photocopied passport is not a consent chain. It is, in any serious audit, evidence of the exact failure the auditor was hired to find. The publishers and platforms who understand this are quietly tightening their submission requirements. The ones who do not yet will, after the first complaint they cannot defend.
For the photographer, the calculation is straightforward. The cost of adopting a verified flow is one of habit, not technology. The cost of not adopting one is borne in the moment a complaint arrives and the folder of releases turns out to be the wrong document, defending against the wrong attack, in the wrong decade.
